CVE-2026-86184criticalCWE-306

CVE-2026-86184: falha crítica em laradashboard

Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar laradashboard

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 1.1%
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
laradashboard · laradashboard
CVEs relacionadas — laradashboard

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86438HIGHLara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install ActionEPSS 1.1%CVE-2026-90932HIGHLaraDashboard 0.9.2 through 1.2.2 Path Traversal RCEEPSS 0.8%CVE-2026-86437HIGHLara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive UploadEPSS 0.7%CVE-2026-86436MEDIUMLara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload EndpointsEPSS 0.5%CVE-2026-105127MEDIUMLaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery EndpointsEPSS 0.5%CVE-2026-105126HIGHLaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role TamperingEPSS 0.5%